PT-2018-13600 · Python · Simplehttpserver

Vulzzz · Publicado 2018-12-04 · Atualizado 2019-10-09 · CVE-2018-16478

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions simplehttpserver versions <=0.2.1 simplehttpserver versions (all versions are affected)

Description The issue allows an attacker to access files outside the webroot due to a Path Traversal vulnerability. This is possible because the vulnerability enables symlink navigation in the URL, allowing the listing of any file in another folder of the web root.

Recommendations For simplehttpserver versions <=0.2.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For all versions of simplehttpserver: Do not use simplehttpserver in production or consider using an alternative module until a fix is made available.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-16478

GHSA-VWR2-WJ63-86GR

Produtos afetados

Simplehttpserver

Referências · 8

• https://github.com/nodejs/security-wg/blob/master/vuln/npm/484.json · Nota
• https://github.com/tikonen/blog/tree/master/simplehttpserver · Nota
• https://osv.dev/vulnerability/CVE-2018-16478 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16478 · Nota de Segurança
• https://github.com/advisories/GHSA-vwr2-wj63-86gr · Nota
• https://osv.dev/vulnerability/GHSA-vwr2-wj63-86gr · Aviso do Fabricante
• https://hackerone.com/reports/403703 · Nota
• https://npmjs.com/advisories/744 · Nota